He had enabled a setting that says "Install [...] security updates". If enabling that setting does not lead to the system installing security updates, that's on Apple.
However, this user made the choice to turn off the installation of system updates manually, based on a false assumption.